Disable print by reference by default - #157
Conversation
michaelrsweet
left a comment
michaelrsweet
left a comment
There was a problem hiding this comment.
See comments.
Since the official stance in the IPP workgroup is that these operations are deprecated, I think it makes sense to update ippeveprinter to default to not supporting these operations, but if a user wants to allow print-by-reference without authentication, that is perfectly OK and is a local security policy choice. Authentication doesn't make these operations any safer.
Ultimately, ippeveprinter is a developer/testing tool and not a production-ready server, so it necessarily has to be more permissive than we might want for a service in general.
| ippAddIntegers(printer->attrs, IPP_TAG_PRINTER, IPP_TAG_ENUM, "operations-supported", sizeof(ops) / sizeof(ops[0]), ops); | ||
| if (printer->uri_jobs) | ||
| { | ||
| attr = ippFindAttribute(printer->attrs, "operations-supported", IPP_TAG_ENUM); |
There was a problem hiding this comment.
Just move the Print-URI and Send-URI operations to the end of the list and adjust the number of values you add.
| *command; // Command to run with job file | ||
| int port; // Port | ||
| bool web_forms; // Enable web interface forms? | ||
| bool uri_jobs, // Enable URI job operations? |
There was a problem hiding this comment.
Rename to print_by_ref (print by reference) which is how we refer to these operations in IPP.
| static ipp_t *create_media_size(int width, int length); | ||
| static ipp_t *create_media_size_range(int min_width, int max_width, int min_length, int max_length); | ||
| static ippeve_printer_t *create_printer(const char *servername, int serverport, const char *name, const char *location, const char *icons, const char *strings, cups_array_t *docformats, const char *subtypes, const char *directory, const char *command, const char *device_uri, const char *output_format, ipp_t *attrs); | ||
| static ippeve_printer_t *create_printer(const char *servername, int serverport, const char *name, const char *location, const char *icons, const char *strings, cups_array_t *docformats, const char *subtypes, const char *directory, const char *command, const char *device_uri, const char *output_format, bool uri_jobs, ipp_t *attrs); |
| *strings = NULL, // Strings file | ||
| *subtypes = "_print"; // DNS-SD service subtype | ||
| bool legacy = false, // Legacy mode? | ||
| bool uri_jobs = false, // Enable URI job operations? |
| { | ||
| web_forms = false; | ||
| } | ||
| else if (!strcmp(argv[i], "--enable-uri-jobs")) |
There was a problem hiding this comment.
"--enable-print-by-reference"
| return (usage(stderr)); | ||
| } | ||
|
|
||
| #if !HAVE_LIBPAM |
There was a problem hiding this comment.
Print-by-reference and authentication are orthogonal issues, so don't bother with this.
| if (!client->printer->uri_jobs) | ||
| { | ||
| flush_document_data(client); | ||
| respond_ipp(client, IPP_STATUS_ERROR_OPERATION_NOT_SUPPORTED, "URI jobs are disabled."); |
There was a problem hiding this comment.
"Print by reference is disabled."
| if (!client->printer->uri_jobs) | ||
| { | ||
| flush_document_data(client); | ||
| respond_ipp(client, IPP_STATUS_ERROR_OPERATION_NOT_SUPPORTED, "URI jobs are disabled."); |
| cupsLangPuts(out, _("Usage: ippeveprinter [OPTIONS] \"NAME\"")); | ||
| cupsLangPuts(out, _("Options:")); | ||
| cupsLangPuts(out, _("--help Show this help")); | ||
| cupsLangPuts(out, _("--enable-uri-jobs Enable authenticated Print-URI and Send-URI operations")); |
There was a problem hiding this comment.
"--enable-print-by-reference Enable the Print-URI and Send-URI operations."
Print-URI and Send-URI are deprecated IPP operations that let clients provide a document URI for the server to retrieve. The printer application currently advertises and enables them by default. Disable print by reference and its related capability attributes by default. Allow an operator to enable the operations explicitly for development and testing with --enable-print-by-reference.
b2e66cd to
73fe656
Compare
acts-1631
changed the title
2 participants
Print-URI and Send-URI are deprecated operations that let a client provide a
document URI for the server to retrieve.
Keep print by reference disabled and unadvertised by default. An operator can
enable the operations explicitly for development and testing.